CVE-2025-14844 is an authorization bypass vulnerability in the Membership Plugin – Restrict Content WordPress plugin. The issue arises from a missing capability check in the 'rcp_stripe_create_setup_intent_for_saved_card' function and the absence of validation on a user-controlled key. This flaw allows unauthenticated attackers to retrieve Stripe SetupIntent client_secret values for any membership, potentially exposing sensitive payment setup credentials. The vulnerability affects all versions up to and including 3.2.16. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, no privileges required, no user interaction, and high confidentiality impact.

An attacker can exploit this vulnerability to leak Stripe SetupIntent client_secret values without authentication. This exposure of sensitive payment setup secrets could lead to unauthorized use or manipulation of payment methods associated with memberships. The integrity and availability impacts are low, but the confidentiality impact is high due to exposure of sensitive credentials.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the vulnerable plugin functionality and monitor for suspicious activity related to Stripe payment setups. Avoid exposing the vulnerable function to unauthenticated users. Follow vendor updates closely for an official fix.